Knowledge Base & Wiki
Document360
UK / wider Europe Report an error0–5 in half steps. 5 means the rubric's top anchor is met on the evidence.
by Document360 Limited · document360.com
Compare with Helpjuice → Report an error on this page Is this your product? →
Link to this page
Add ?theme=dark to the image address for dark backgrounds.
The badge shows the category and the month of the latest evaluation, and EU-Made where
that is the product’s provenance. It never shows a score.
Document360 at a glance
- Vendor
- Document360 Limited
- Headquarters
- Not stated on the vendor’s pages as of 1 Nov 2026
- Data hosting
- Not stated on the vendor’s pages as of 1 Nov 2026
- Free plan
- Not stated on the vendor’s pages as of 1 Nov 2026
- Panel verdict
- The AI panel rates Document360 3.5/5, the mean of 6 judges. Document360, a knowledge base and wiki from Document360 Limited, part of the Kovai Group, scores strongest on publishing and integrations (8 to 9): branded site with custom domain and SEO tool kit, translation into 50-plus languages, Zendesk and Freshdesk integration with ticket deflection, a documented REST API, and an MCP server keeping AI assistants inside the governance model. how scores are made
- As of
- Vendor pages captured 1 Nov 2026; evaluated by the panel 1 Nov 2026. all sources
Read this page as one judge. Each weighs the same scores by what they care about.
The panel's verdict
Document360, a knowledge base and wiki from Document360 Limited, part of the Kovai Group, scores strongest on publishing and integrations (8 to 9): branded site with custom domain and SEO tool kit, translation into 50-plus languages, Zendesk and Freshdesk integration with ticket deflection, a documented REST API, and an MCP server keeping AI assistants inside the governance model. Authoring and search (7 to 8) and access control (7 to 8) follow, with WYSIWYG and Markdown editors, co-editing with visible cursors, permission-aware AI search, and SAML, OpenID Connect and JWT sign-on with SCIM provisioning. Knowledge governance sits at 7. Sovereignty splits 4 to 6: higher scores credit a named subprocessor chain plus SOC 2 Type II and ISO 27001:2022; lower ones weigh a UK contracting entity, stated transfers outside the EEA especially to India, and no published data processing agreement on the captured pages. Portability and hosting sits uniformly at 6 — managed migration in, a thirty-day export window out, no on-premises deployment per the documentation, private hosting vendor-managed on Azure. Pricing pages state no figures; entry is a demo request.
Speaks for it
- Publishing and integrations is the strongest criterion (8 to 9), covering a branded custom-domain site with an SEO tool kit, Zendesk and Freshdesk integration with ticket deflection, and an MCP server that operates within the existing governance model
- Access control (7 to 8) documents SAML, OpenID Connect and JWT sign-on with SCIM provisioning, IP restrictions, and AI answers that respect each reader's permissions
- Authoring and search (7 to 8) pairs WYSIWYG and Markdown editors with real-time co-editing with visible cursors and Eddy AI search that cites the source article
- Knowledge governance (7) documents custom review statuses with up to twenty assignees per status, mandatory comments stored in version metadata, review reminders, and a scheduled monthly duplicate-content scan
- Subprocessors including the AI provider are listed at the trust center, with SOC 2 Type II and ISO 27001:2022 published and a stated commitment that customer content is not used to train AI models
Held against it
- Sovereignty scores split 4 to 6: the contracting entity is UK-based, EU storage is a selectable Western Europe region rather than a stated default, transfers outside the EEA — especially to India — are stated, and we found no public information on a published data processing agreement
- Portability and hosting sits at 6: the documentation states no on-premises deployment is offered, and private hosting is a dedicated, vendor-managed Azure environment
- ZIP and WebHelp export is stated for Business and Enterprise plans, and we found no public information on an export that includes page history in an open format
- We found no public information on enforced two-factor authentication or on exporting audit logs to a SIEM
- We found no public information on API SDKs or stated rate limits for the documented REST API
Best for
- You run internal knowledge for support, IT or HR teams and need SAML, OpenID Connect or JWT sign-on with SCIM provisioning and AI answers that respect each reader's permissions
- You publish a public help center and internal documentation from one source, with Zendesk or Freshdesk ticket deflection and single-click switching between internal and external audiences
- Your content must route through named reviewers with mandatory comments preserved in version history, backed by audit logs for a certifier
- You want AI assistants such as ChatGPT to search, retrieve and publish through an MCP server that stays inside your existing version and visibility settings
Avoid if
- You need to run the software in your own data centre — the documentation states no on-premises deployment is offered, and private hosting remains a dedicated, vendor-managed Azure environment
- You require EU-only processing — ask the vendor: the public pages we read do not show it
- You must budget a full year from public pages — the captured pricing pages state no figures, fees are invoiced annually in advance and are non-refundable, and renewal fees may increase by CPI plus three percent
The scores
| Criterion | Panel median |
|---|---|
| Editor, structure & search | 3.5 of 5 |
| Verification, ownership & freshness | 3.5 of 5 |
| Permissions, SSO & administration | 4 of 5 |
| Help-center publishing & integrations | 4 of 5 |
| Import, export & self-hosting | 3 of 5 |
| European sovereignty | 2.5 of 5 |
Verification, ownership & freshness
Show reasoningHide reasoning
How this is scored
Whether the content stays true: page owners or experts named per page, verification with a review date and a reminder when it lapses, approval or publishing workflows with drafts and reviewers, read confirmations for mandatory pages, analytics on views, searches without a result and stale pages, duplicate detection, archiving rules, and an audit trail of who changed and approved what.
0 — No way to see who owns a page or when it was last checked beyond the edit date.
3 — Page history and last-edited dates; owners, verification, approvals and content analytics are basic or not described.
5 — An owner or verifier per page, a review interval with reminders, a draft and publish step, page view statistics, and archived pages kept out of search.
8 — Approval workflows with several reviewers, read confirmations for mandatory pages, analytics on failed searches and stale content, duplicate or outdated content flagged automatically, and an exportable audit trail of changes and approvals.
10 — Governance that a regulated organisation runs on: controlled documents with versioned approvals that meet a named standard (ISO 9001, GxP), expiry and review enforced per space, knowledge gaps reported from searches and AI questions, and every published statement traceable to an approved version.
The Operations Lead
This is the part I care most about and it holds up: a custom workflow builder routes pages through named reviewers with custom statuses such as peer, SME or legal review, mandatory comments stored in version metadata, review reminders that flag stale articles to their owner, a duplicate content scanner with a scheduled monthly run, and analytics that show failed searches and page-not-found so knowledge gaps surface as data, with every action from edits to permission changes tracked in audit logs. We found no public information on read confirmations for mandatory pages, and whether the audit trail can be exported is not described. 2 3 7 18 19
The IT Administrator
The workflow designer is documented in detail: custom review statuses between draft and published, up to twenty assignees per status, read-only states, and mandatory approval comments preserved in version history and PDF exports. Review reminders flag stale articles to their owner, failed searches are reported, duplicate content is scanned on an automatic monthly schedule, and audit logs cover content edits, user management and permission changes. We found no public information on read confirmations for mandatory pages or on a bulk-exportable audit trail, so it sits just under the stronger governance description. 18 19 3 2
The Support Knowledge Manager
The workflow designer routes articles through named reviewers with custom statuses such as SME or Legal review, up to twenty assignees per status and mandatory comments stored in version history, while review reminders flag stale articles to their owner. Analytics cover searches, failed searches and reads so gaps surface as data, and duplicate content is scanned monthly with recommendations to convert repeats into snippets. We found no public information on read confirmations for mandatory pages or on an exportable audit trail of changes and approvals. 18 3 19 7
The Engineering Lead
The custom workflow builder routes content through named reviewers with custom statuses like Peer review or Legal review, up to twenty assignees per status and mandatory comments kept in version metadata, while review reminders flag stale articles to owners and analytics expose failed searches and duplicate content detection runs monthly. We found no public information on read confirmations for mandatory pages, and the exportability of the audit trail is not described. 18 3 19 7 2 13
The Quality Manager
This is close to what our certifier asks for: a workflow designer where admins define custom stages such as Legal review with named assignees (up to twenty per status), mandatory comments stored in version metadata and carried into PDF exports, review reminders that flag stale articles to their owner, and failed-search plus duplicate-content reporting surfacing as data. Every action from content edits to permission changes is recorded in audit logs, and publishing through the workflow leaves its mark in version history. We found no public information on read confirmations for mandatory pages, and none on exporting the audit trail itself for the certifier. 18 3 19 2
The Skeptic
Workflows are genuinely documented rather than hinted at: Draft and Published fixed with custom statuses like Legal review between them, up to twenty assignees per status, mandatory publish comments stored in version metadata and visible in PDF exports, review reminders that flag stale articles to their owner, failed-search and page-not-found analytics, and a monthly duplicate-content scan that recommends snippets. I found no public information on read confirmations for mandatory pages or on whether the audit trail can be exported. 2 3 18 19
Permissions, SSO & administration
Show reasoningHide reasoning
How this is scored
Who may see and edit what, and how the administrator keeps control: roles and permissions per space and per page, restricted or private pages, guest and external access, groups synced from Azure AD/Entra ID, Google Workspace or LDAP, single sign-on (SAML, OIDC), SCIM provisioning, two-factor authentication enforced, an audit log of access and permission changes, and admin controls over sharing and public links. Where the data is hosted and certifications are scored under sovereignty.
0 — Everyone in a workspace sees and edits everything; no permissions of any kind.
3 — Admins, members and guests, or private and shared pages; per-space or per-page rights, SSO and an audit log are basic or not described.
5 — Permissions per space and per page, guest access with limits, single sign-on through Google or Microsoft, two-factor authentication, groups, and admin control over public sharing.
8 — SAML or OIDC single sign-on with any identity provider, SCIM provisioning or LDAP and directory group sync, enforced 2FA, an audit log of views, edits and permission changes, IP or domain restrictions, and permissions honoured by search and AI answers.
10 — Access control an enterprise auditor accepts as documented: granular roles with inheritance explained, just-in-time and external access with expiry, every access and permission change logged and exportable to a SIEM, and the permission model published with its limits.
The Operations Lead
Access control is documented in unusual depth: SAML and OpenID Connect with named identity providers, SCIM user, group and reader provisioning with real-time group sync and inheritance from a parent project, roles from writer to admin plus custom roles, IP restrictions, reader segmentation scoping private categories, and AI answers that respect each reader's permissions — and the documentation even publishes its own limits, such as SCIM with Entra working only over SAML. We found no public information on enforced two-factor authentication or on exporting the audit log to a SIEM. 2 3 5 13 20 21
The IT Administrator
This meets most of what I run: SAML SSO with Entra ID documented step by step, SCIM user and reader provisioning with real-time group membership sync from Entra, IP restrictions, roles from owner to reader, private projects scoped by reader group, and audit logs of content, user-management and permission changes, with AI answers respecting each reader's permissions. The documentation is refreshingly frank about limits — SCIM with Entra works only over SAML, requires a non-gallery app, and deleting a user in Entra sets them inactive rather than removing the profile. We found no public information on enforced two-factor authentication or on exporting access logs to a SIEM. 20 21 2 5 3
The Support Knowledge Manager
SAML, OpenID Connect and JWT single sign-on are documented with named identity providers including Okta, Entra ID and Google, and SCIM provisioning is documented in real depth: real-time group sync, reader provisioning, inheritance from parent projects, and stated limits such as Entra SCIM working only through SAML and Google not supporting SCIM. Audit logs track every action from content edits to permission changes, IP restrictions and private projects with reader groups are documented, and both general search and Eddy AI honour permissions, with conditional content excluded from the search index. We found no public information on enforced two-factor authentication. 5 20 21 2 3 17
The Engineering Lead
SAML, OpenID Connect and JWT are supported with named identity providers, SCIM provisioning and real-time group sync are documented down to token rotation and inherited configurations, with IP restrictions and audit logs covering edits, user management and permission changes, and AI answers that respect each reader's permissions. Enforced two-factor authentication is not described in the captured pages. 5 20 21 2 3 17
The Quality Manager
SAML 2.0, OpenID Connect and JWT single sign-on with named providers, SCIM provisioning with real-time group sync and inheritance from a parent project, private projects behind SSO with reader groups and IP restrictions, and audit logs covering permission changes are documented in step-by-step guides I could hand to our IT auditor. AI answers respect each reader's permissions, so restricted content stays out of the answers people should not see. We found no public information on enforced two-factor authentication. 20 21 5 3 2
The Skeptic
SAML, OpenID Connect and JWT with named identity providers, SCIM user, reader and group provisioning synced in real time from Entra, IP restrictions, reader groups scoping private projects, and audit logs that cover permission changes — and the documented claim that AI answers respect each reader's permissions is exactly the claim I look for. The limits are documented honestly (SCIM with Entra works only through SAML, and not with Google), but I found no public information on enforced two-factor authentication. 2 3 5 20 21
Help-center publishing & integrations
Show reasoningHide reasoning
How this is scored
How knowledge reaches people outside the editor: public or password-protected sites and help centers with a custom domain, branding and SEO controls, an in-app widget or contextual help, ticket deflection in a help desk, multilingual publishing, integrations with Slack, Microsoft Teams, Jira, Google Drive, help desks and CRMs, a browser extension, a documented REST or GraphQL API, webhooks, and an MCP server or connector for AI assistants.
0 — Content cannot be shared beyond the editor and nothing connects to it.
3 — Sharing a page by public link and a few integrations such as Slack; a branded help center, an API and webhooks are basic or not described.
5 — A published site or help center with custom domain and branding, integrations with Slack or Teams and Google Drive or Microsoft 365, a documented API, and embeds of common tools.
8 — A help center with SEO controls, multilingual publishing, access for logged-in customers and analytics, a widget or contextual help inside the customer's product, help desk integration with ticket deflection, webhooks, and a connector or MCP server for AI assistants.
10 — Knowledge delivered wherever it is needed from one source: internal and public audiences served from the same pages with per-audience rules, a complete API with SDKs and rate limits stated, a marketplace of integrations, and every channel measured in one report.
The Operations Lead
Publishing outwards is fully covered: a branded knowledge base site with custom domain and SEO controls, translation into 50-plus languages, logged-in reader access with analytics, an in-app widget and embedded help, help-desk integration with Zendesk and Freshdesk plus a ticket deflector, webhooks, 60-plus connectors, and an MCP server that lets AI assistants search, retrieve, create and publish within the existing governance model. A REST API and an integration marketplace are documented; we found no public information on rate limits or SDKs for the API. 1 4 7 8 22 23
The IT Administrator
This is the strongest area: a branded site with custom domain, SEO tool kit and scheduled publishing; an in-app widget and embedded help; Zendesk and Freshdesk integrations with ticket deflection and AI-drafted answers; webhooks; a documented REST API with a Swagger hub; and an MCP server through which assistants can search, retrieve, create, update and publish within the existing version and visibility rules. Multilingual publishing to more than fifty languages and single-click switching between internal and external audiences from the same content are both stated. We found no public information on API SDKs, stated rate limits, or one report measuring every channel. 4 8 22 23 7
The Support Knowledge Manager
Everything I need to reach people outside the editor is documented: a branded help center on a custom domain with SEO and GEO tooling, publishing into fifty-plus languages, single-click switching between internal and external audiences, and a knowledge base widget or AI chatbot embedded in our own product. Zendesk and Freshdesk integrations put article search and AI-drafted replies inside the ticket view with a support ticket deflector, and there is a documented REST API with a Swagger hub, webhook notifications, an Eddy AI endpoint to embed assistive search in our own platform, and an MCP server through which assistants such as ChatGPT can search, create and publish while staying inside the governance model. We found no public information on API SDKs or stated rate limits. 4 7 8 22 23 2
The Engineering Lead
A published site with custom domain, branding and an SEO/GEO toolkit, an in-app widget and embedded help, Zendesk and Freshdesk integrations with ticket deflection and AI-drafted replies, multilingual publishing through Crowdin, webhooks, sixty-plus connectors, a documented REST API hub, a public API to embed the AI search in our own product, and an MCP server that can create, update and publish within our governance model. API rate limits and SDKs are not stated. 4 8 7 22 23 9
The Quality Manager
The whole delivery chain is documented: branded public sites with custom domain and SEO controls, an in-app widget and embedded help, Zendesk and Freshdesk help desk integration with ticket deflection, webhooks, a documented REST API with a Swagger hub, and an MCP server through which AI assistants can search, retrieve, create and publish — with more than sixty connectors and one-click switching between internal and external audiences. We found no public information on API SDKs, stated rate limits, or one report measuring every channel. 4 8 22 23 1
The Skeptic
The strongest area of the evidence: custom domain and no-code branded site, an SEO toolkit, translation into 50+ languages, an in-app widget and embedded help, ticket deflection with Zendesk and Freshdesk including AI-drafted replies, webhooks, a documented REST API, an MCP server that lets ChatGPT-class assistants search, edit and publish within existing governance, and a public API to embed AI answers inside your own product. I found no public information on SDKs or stated rate limits, or on every channel being measured in one report. 1 2 4 8 22 23
Import, export & self-hosting
Show reasoningHide reasoning
How this is scored
What arriving and leaving would cost: import from Confluence, Notion, Google Docs, Word and Markdown with structure, attachments and links kept, a full export of every space in an open format (Markdown, HTML, XML, PDF) with attachments and history, an API that reaches all content, a stated migration path from Confluence Server or Data Center, open-source code under a named licence, and a self-hosted or on-premise edition with its own documentation.
0 — Content cannot be imported or exported; it can only be read in the vendor's interface.
3 — Single pages export to PDF or Word and some files can be imported; a full export, a Confluence import and self-hosting are basic or not described.
5 — Import from Confluence or Notion and from Word or Markdown, a full workspace export to Markdown or HTML with attachments, a documented API covering pages, and a stated retention of data after cancellation.
8 — A Confluence migration tool or service that keeps hierarchy, permissions and attachments, a full export with history in an open format, a self-hosted or on-premise edition with installation and update documentation, and data returned or deleted on termination under stated terms.
10 — The customer owns the content end to end: open-source code under a named licence that runs fully self-hosted with feature parity stated, a complete export another tool can import without loss, and the deletion of every copy on termination documented.
The Operations Lead
Arriving is well handled: import and managed migration from Confluence, Zendesk, Word, SharePoint and Google Docs, including a white-glove service with planning, content mapping and validation, plus ZIP and offline WebHelp export — a self-contained HTML site with navigation and search — on Business and Enterprise plans. Leaving is weaker: the captured pages state that no on-premises deployment is offered, private hosting is dedicated Azure managed by the vendor, and export including page history is not described, though the terms do give a 30-day export window after termination with deletion to follow. 1 7 15 24 25
The IT Administrator
Confluence is a named migration source and the move is a managed service with planning, content mapping, data transfer and validation, with ZIP import and ZIP or WebHelp export for offline use, a thirty-day export window after termination and deletion following it under the terms. The captured pages do not state that the migration preserves hierarchy, permissions and attachments — the things twelve years of Confluence depend on — and a full export including history in an open format is not described. The product documentation states that no on-premises deployment option is offered; private hosting is a dedicated but vendor-managed Azure environment, not an edition I can run in the utility's own data centre. 1 7 24 25 15
The Support Knowledge Manager
Arriving is well covered: imports from Confluence, Zendesk, Word, SharePoint and Google Docs, a ZIP import for migration or recovery, and a managed white-glove migration service with validation after migration. Leaving is covered by PDF export plus ZIP and self-contained offline WebHelp HTML export on Business and Enterprise plans and a stated thirty-day export window after termination with deletion to follow, though we found no public information on a full export including page history in an open format. The private hosting documentation states there is no on-premises deployment option, and private hosting remains a vendor-managed Azure environment with provisioning, patching and monitoring handled on our behalf. 1 7 24 25 15
The Engineering Lead
Migration is covered from Confluence, Zendesk, Word, SharePoint and Google Docs with a managed service for planning, mapping, transfer and validation, plus ZIP and self-contained WebHelp export on Business and Enterprise plans, a thirty-day export window after termination, and affirmed customer ownership of content. The documentation states an on-premises deployment is not offered since private hosting is a vendor-managed dedicated Azure environment, and export with version history in an open format is not described. 24 15 7 1 25 6
The Quality Manager
Arriving is well covered — import from Confluence, Zendesk, Word, SharePoint and Google Docs plus a managed migration service with planning, content mapping, validation and ZIP-based recovery — and leaving is covered by ZIP, WebHelp and PDF exports, a 30-day post-termination export window in a machine-readable format, deletion thereafter, and customer ownership of content confirmed in the terms. The documentation states outright that no on-premises deployment option is offered; private hosting is a dedicated, vendor-managed Azure environment. We found no public information on an export that includes page history, or on an open-source edition. 24 7 15 25 1
The Skeptic
Arriving is well covered — import from Confluence, Zendesk, Word, SharePoint and Google Docs plus a managed migration service, and a ZIP export that can be re-imported for recovery — and leaving has a thirty-day export window after termination, deletion afterwards, and EU Data Act switching assistance. But export is limited to Business and Enterprise plans, the terms leave the export format to the provider's determination, version history in exports is not described, and the documentation states plainly that no on-premises deployment is offered; private hosting is dedicated Azure managed by the vendor, not servers you run. 1 7 15 24 25
European sovereignty
panel opinion
Show reasoningHide reasoning
How this is scored
Who the contracting entity and the parent company are, where pages, attachments and search indexes are stored and processed, and who the subprocessors are (hosting, CDN, search, email, support, payment, and the AI model provider that reads pages for answers and summaries, with whether content is used for training). Independently sourced by the sovereignty pipeline; a wiki holds internal processes, customer data and trade secrets, so the whole chain counts, not only the database. A self-hosted or open-source edition the customer runs on its own European servers counts as the customer's chain, whatever the vendor's seat.
0 — Non-EU vendor and contracting entity, hosting unstated, subprocessors unnamed, and no data processing agreement offered.
3 — A privacy policy and a data processing agreement exist, but hosting location is unstated or non-EU and the subprocessors are not listed.
5 — EU data residency available and an EU contracting entity or EU representative, but parts of the chain (CDN, search, email, support, AI model) run through non-EU providers without a stated safeguard, or EU residency is limited to the higher tiers.
8 — EU hosting on named infrastructure, EU contracting entity, subprocessors listed with their locations including the AI model provider, no training on customer content stated, a data processing agreement published, and security certifications (ISO 27001, SOC 2) stated — or a self-hosted edition documented that keeps every page on the customer's own servers.
10 — Sovereign end to end and evidenced: European ownership, entity, hosting and every subprocessor including AI, or a self-hosted open-source edition with no call home, data export and deletion documented, and certifications published with their scope rather than implied.
The Operations Lead
The contracting entity is Document360 Limited in the UK-based Kovai Group, not an EU entity; EU residency is possible but only as the customer's choice of the Western Europe Azure region among three selectable regions, with no default region stated, and the chain runs through non-EU providers — OpenAI for AI, an India-based support team and processing in India, Cloudflare and Google — with transfers to countries without an adequacy decision acknowledged. In its favour: subprocessors including the AI provider are listed and maintained at the trust center, customer content is stated not to be used to train AI models, and SOC 2 Type II and ISO 27001 are stated; we found no public information on a published data processing agreement. 1 11 12 14 25
The IT Administrator
The contracting entity is Document360 Limited, part of the Kovai Group with England-incorporated sister companies and the ICO named as regulator, and the privacy policy states transfers outside the EEA, especially to India where the support team processes personal data. EU storage is a selectable shared region (Western Europe, on named Azure infrastructure) rather than a stated default, and the published chain names Cloudflare, OpenAI for AI, MongoDB as vector database, Mixpanel, Segment, Google and Stripe, with the privacy policy stating no training on customer content and retention at AI subprocessors not beyond thirty days. SOC 2 Type II and ISO 27001:2022 are published, a DPO is appointed and processor/controller roles are set out in the terms, which makes the chain disclosed and workable but not European end to end. 14 12 25 11 15
The Support Knowledge Manager
The privacy policy names Document360 Limited, part of the Kovai Group with sister companies incorporated in England, and names the UK Information Commissioner's Office as the regulator; we found no public information on an EU contracting entity or EU representative. Shared hosting runs in one of three selectable regions including Western Europe and private hosting offers fifty-plus Azure regions, but no EU default is stated, and the GDPR page states personal data may be transferred to countries outside the EEA, especially to India, where the support team is based. Strong marks for transparency: the trust center and privacy policy list subprocessors including OpenAI as the AI provider with retention capped at thirty days, state that customer content is not used to train AI models, and SOC 2 Type II and ISO 27001 are claimed, though we found no published data processing agreement or stated safeguards for the non-EU transfers. 14 12 11 25 15
The Engineering Lead
A Western Europe Azure region is selectable for shared hosting with no default region stated, the contracting entity is part of the UK-based Kovai Group, and subprocessors are named at a Trust Center with OpenAI identified as the AI provider, no training on customer content stated, and SOC 2 Type II plus ISO 27001:2022 certifications. The captured pages state processing outside the EEA including India, and no safeguard for the non-EU parts of the chain is captured. 25 14 12 11 13 1
The Quality Manager
Document360 Limited, part of a group whose sister companies are incorporated in England, contracts as a UK entity; Western Europe is one of three customer-selectable regions for shared Azure hosting, private hosting spans more than fifty Azure locations, and the subprocessor list is public and names OpenAI as the AI provider, with a statement that customer content is not used to train or fine-tune AI models plus SOC 2 and ISO 27001 certifications. Against that, processing outside the EEA is stated — especially to India for support — with US providers across the chain, no default region is stated, and we found no public information on a published data processing agreement. 25 14 12 11
The Skeptic
The chain is named, which I respect: Azure hosting with a selectable Western Europe region though no stated default, OpenAI disclosed as the AI provider that reads the pages, a written commitment not to train on customer content with a thirty-day cap on AI subprocessor retention, and SOC 2 Type II and ISO 27001:2022 stated. But the contracting entity is UK-based Document360 Limited within the Kovai Group rather than an EU entity, support and an associated company process data in India, and US providers run through the chain with no transfer safeguard stated in the pages I read. 1 11 12 14 15 25
Pricing transparency
not rated — the vendor publishes no price
Show reasoningHide reasoning
How this is scored
Whether a buyer can compute the real annual cost from public pages alone: price per user and tier, readers or guests free or charged, minimum seats, which features (SSO, SCIM, audit log, verification, help-center publishing, custom domain, AI answers, EU data residency) cost extra, the free tier and its limits, storage limits, the self-hosted edition's licence and support price, minimum term and setup or migration fees.
0 — No public prices at all; every customer is a sales call.
3 — A starting price or a free tier exists, but how cost scales with users, readers or features is unclear.
5 — Tiers are public with their price per user and main inclusions, but at least one commonly needed piece (SSO, AI, readers or guests, EU residency, the self-hosted edition) is unpriced or "on request".
8 — Every tier priced publicly with its scaling rule (editors, readers, guests, storage), add-ons priced, the self-hosted edition's licence and support cost stated, minimum seats, term and VAT treatment stated.
10 — Complete price computability: annual cost derivable for a given number of editors and readers and a feature set, with every add-on, AI credit, setup, migration and support fee and the cancellation and data-return terms published.
The Operations Lead
For a buyer who must budget a year ahead this is the weak point: a pricing page exists and plan names such as Business and Enterprise appear, but the captured pages state no prices at all, and every route to purchase shown runs through a demo request. The terms publish billing mechanics — annual invoicing in advance, non-refundable, auto-renewal with 60-day notice, renewal increases of CPI plus three percent, overage billing, fees exclusive of VAT — yet no per-user price, reader price, storage limit or private-hosting cost is stated anywhere, so the real annual cost cannot be computed from public pages. 1 9 15 23 24
The IT Administrator
We found no public price figure on the captured pricing pages: the page names features under a "flexible, need-based pricing model", the call to action is a demo request, and the terms place all fees in the Order Form. The terms do state the commercial frame — invoiced annually in advance and non-refundable, auto-renewal with sixty days' notice, renewal increases of CPI plus three percent, fees exclusive of VAT, overage at standard rates — but an annual cost for nine hundred staff cannot be computed from public pages, and we found no public information on reader or guest charges, AI pricing, or the price of private hosting. 9 7 23 15
The Support Knowledge Manager
A pricing page exists, but the captured pages give no price figures at all, describing a flexible, need-based model and pointing to a demo request, so I cannot compute what twenty-five agents plus our readers would cost. The terms do publish the mechanics — annual invoicing in advance, non-refundable, auto-renewal with sixty days' notice, renewal uplift of CPI inflation plus three percent, overage billed at the vendor's standard rates, and fees exclusive of VAT — but no tier price, per-user price, reader or guest pricing, seat minimums or free tier limits appear on any page we read. 9 23 7 15 1
The Engineering Lead
The captured pricing page lists feature names under a flexible, need-based pricing model with no figures, entry is by demo request, and only the tier names Business and Enterprise surface, from the export documentation. Terms add annually-in-advance invoicing, non-refundable prepaid fees, sixty-day non-renewal notice, renewal increases of CPI plus three percent and taxes exclusive, so no annual cost is computable from the public pages alone. 23 9 7 15 24 1
The Quality Manager
The captured pricing pages give feature names and a flexible, need-based model with no price figures, and the route in is a demo request; the terms publish billing mechanics — annual invoicing in advance, non-refundable, renewals that may rise by CPI inflation plus three percent, fees exclusive of VAT — but no amounts. We found no public information on per-user prices, tier prices, whether readers or guests are charged, storage limits, or the private hosting licence cost. 9 23 7 15
The Skeptic
No price per user appears on any page I read — the pricing page describes a flexible, need-based pricing model and plan names surface only incidentally — and the entry path is a demo request. The terms publish the mechanics (annual invoicing in advance, non-refundable, a CPI plus three percent renewal escalator, fees exclusive of VAT, overage billed at standard rates), but a buyer cannot compute a real annual cost from public pages, and I found no public information on reader or guest pricing, a free tier with limits, or minimum seats. 1 7 9 15 23
European sovereignty — proven facts
0 of 6 dimensions provenBuilt only from facts shown on the vendor's own pages. A dimension we could not prove is left open, not scored as zero.
| Legal entity | Not determined | — | uncited Report an error |
|---|---|---|---|
| Hosting location | Not determined ⚠ unverified | — | uncited Report an error |
| Hosting options | Not determined ⚠ unverified | — | uncited Report an error |
| Open source | Not determined | — | uncited Report an error |
| Data processing agreement | Not determined | — | uncited Report an error |
| Transfer impact assessment | Not determined | — | uncited Report an error |
Questions about Document360
Is Document360 European?
Yes, though not from the EU. whats-best.ai classifies Document360 as UK / wider Europe.
Where does Document360 store data?
Not stated on the vendor’s pages as of 1 Nov 2026.
Does Document360 have a free plan?
Not stated on the vendor’s pages as of 1 Nov 2026.
What are the best alternatives to Document360?
As of 1 Nov 2026, the panel rates BookStack (3/5), XWiki (3/5) and Docmost (3/5) highest among the other 13 Knowledge Base & Wiki products evaluated. Ratings that look equal are rounded to half stars; the order uses the unrounded rating, then the name. The highest-rated European alternative is BookStack (UK / wider Europe). Ratings are the AI panel’s opinion, formed from public evidence: how scores are made. The full list, with European products first: Document360 alternatives.
Where this could be wrong
- Evidence ages. The oldest capture behind this page is from 1 Nov 2026. Vendors change pricing and policies without notice; every fact reflects its source as of the capture date shown in the registry.
- Weak sourcing — Hosting location. No default region is stated anywhere; the Western Europe Azure region is one of three selectable options (and 50+ regions on private hosting), so EU storage is a customer choice rather than a stated EU default.
- Weak sourcing — Hosting options. Not confirmed on the vendor’s own pages as captured.
- AI can misread a source. Extraction and judgement are automated; a citation guarantees traceability, not infallibility. If something here is wrong, say so — no account needed, every report is decided within 5 business days, and accepted corrections are published.
What we left out
A claim that does not survive our checks costs us the claim, not the page. This is what was taken off this one.
- 22 product facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material. Know more? Tell us
- 2 legal facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material. Know more? Tell us
- 2 pricing facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material. Know more? Tell us
- 1 compliance fact could not be confirmed on the vendor’s page as captured and was left out of this page and of the panel’s material. Know more? Tell us
- 1 hosting fact could not be confirmed on the vendor’s page as captured and was left out of this page and of the panel’s material. Know more? Tell us
- 1 integrations fact could not be confirmed on the vendor’s page as captured and was left out of this page and of the panel’s material. Know more? Tell us
- 1 sovereignty dimension could not be confirmed on the vendor’s own pages and is shown as unknown. Know more? Tell us
- 6 of the readings below were written against an earlier fact sheet — a fact has been corrected, added or pulled since. Until the panel next runs on this product you are reading the older judgement. Know more? Tell us
Sources (25)
The pages every claim on this page was read from — each one checked, dated, and kept verifiable.
- 1 Vendor homepage document360.com Checked 1 Nov 2026 Details →
- 2 Features page document360.com Checked 1 Nov 2026 Details →
- 3 Features page (internal knowledge base) document360.com Checked 1 Nov 2026 Details →
- 4 Features page (published knowledge base site) document360.com Checked 1 Nov 2026 Details →
- 5 Features page (SSO and SCIM) document360.com Checked 1 Nov 2026 Details →
- 6 Features page (private hosting) document360.com Checked 1 Nov 2026 Details →
- 7 Features page (migration) document360.com Checked 1 Nov 2026 Details →
- 8 Integrations page document360.com Checked 1 Nov 2026 Details →
- 9 Pricing page document360.com Checked 1 Nov 2026 Details →
- 10 Security page document360.com Checked 1 Nov 2026 Details →
- 11 Trust center document360.com Checked 1 Nov 2026 Details →
- 12 GDPR page document360.com Checked 1 Nov 2026 Details →
- 13 Documentation docs.document360.com Checked 1 Nov 2026 Details →
- 14 Privacy policy document360.com Checked 1 Nov 2026 Details →
- 15 Terms of service document360.com Checked 1 Nov 2026 Details →
- 16 Editor, structure & search — found from sitemap docs.document360.com Checked 1 Nov 2026 Details →
- 17 Editor, structure & search — found from sitemap docs.document360.com Checked 1 Nov 2026 Details →
- 18 Verification, ownership & freshness — found from sitemap docs.document360.com Checked 1 Nov 2026 Details →
- 19 Verification, ownership & freshness — found from sitemap docs.document360.com Checked 1 Nov 2026 Details →
- 20 Permissions, SSO & administration — found from sitemap docs.document360.com Checked 1 Nov 2026 Details →
- 21 Permissions, SSO & administration — found from sitemap docs.document360.com Checked 1 Nov 2026 Details →
- 22 Help-center publishing & integrations — found from sitemap docs.document360.com Checked 1 Nov 2026 Details →
- 23 Help-center publishing & integrations — found from sitemap docs.document360.com Checked 1 Nov 2026 Details →
- 24 Import, export & self-hosting — found from sitemap docs.document360.com Checked 1 Nov 2026 Details →
- 25 Import, export & self-hosting — found from sitemap docs.document360.com Checked 1 Nov 2026 Details →